mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
Prageeth Panicker
bf37d5e7b3
Tor: use the shared tor block (bond 0.5, enabled when svc-net-tor is in the node's groups, tor pinned on in both variants) so a node serves one network, onion on a Tor node and clearnet otherwise. SPOT and sizing: WAZUH_INDEXER_URL replaces four hand-built copies of the indexer URL, and the indexer heap is half of mem_limit instead of a hardcoded 1g (unchanged for the current 2g limit). Fixes: bcrypt_hash rejects secrets over 72 bytes; the Keycloak group-removal helper uses the same resolver as the add helper and checks every response (the realm is no longer URL-encoded, matching the add helper), and a failed cleanup fails an otherwise passing test; the swarm certs generator removes a stale container before each attempt; vm.max_map_count is set before the early handler flush; securityadmin failed_when now needs rc 0 and the success marker. The regenerated role README also picks up generator drift (mailu to stalwart).
20 lines
862 B
YAML
20 lines
862 B
YAML
---
|
|
- name: "▶️ Run securityadmin.sh inside the indexer container"
|
|
ansible.builtin.shell:
|
|
cmd: >-
|
|
container exec -e JAVA_HOME=/usr/share/wazuh-indexer/jdk {{ WAZUH_INDEXER_CONTAINER_ADDRESS }}
|
|
/usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh
|
|
-cd {{ WAZUH_INDEXER_SECURITY_DIR_CONTAINER }}/
|
|
-icl
|
|
-key {{ WAZUH_INDEXER_CERTS_DIR_CONTAINER }}/admin-key.pem
|
|
-cert {{ WAZUH_INDEXER_CERTS_DIR_CONTAINER }}/admin.pem
|
|
-cacert {{ WAZUH_INDEXER_CERTS_DIR_CONTAINER }}/root-ca.pem
|
|
-nhnv
|
|
chdir: "{{ WAZUH_INSTANCE_DIR }}"
|
|
register: wazuh_securityadmin
|
|
changed_when: "'Done with success' in wazuh_securityadmin.stdout"
|
|
failed_when: wazuh_securityadmin.rc != 0 or 'Done with success' not in wazuh_securityadmin.stdout
|
|
retries: 10
|
|
delay: 10
|
|
until: wazuh_securityadmin.rc == 0
|